Complexity of services offered for users of communication networks grows continuously. Many services are such that the users may not be able to configure all details required for setting up the service, or such that it is not be feasible for the users to do all the configuration. For example a conference call with participants from different countries and timezones may be challenging to setup, especially, if the conference call should be prescheduled.
In order to make things easier and efficient for the users, application servers offering the services may act on behalf of the users. For this reason it has already been defined in 3GPP (3rd Generation Partnership Project) specification TS 23.228 v.8.0.0, section 4.2.4 that a SIP (Session Initiation Protocol) Application Server should be allowed to originate sessions on behalf of a user. Implementation issues relating to such procedure have not been agreed on yet, though.
If the application server is fully trusted (e.g. part of network operator's network and administered by the network operator), it is likely that there are no security issues in allowing session initiation on behalf of users. It is however common that all network elements cannot be assumed to be trustworthy. For example, all network elements are often no longer administered by the network operators themselves (some of them may be outsourced for example), or roaming partners that may not be fully trusted, may be involved. For example premium SMS services suffer from that lack of trust, as it is possible that an untrustworthy roaming partner charges high fees from users home operator, even though the user has not used the service. Some network operators may even completely disable this kind of premium SMS services from roaming users for security and fraud reasons.
If all application servers are not a trusted network elements there may be a risk that allowing application servers to set up sessions on behalf of users can result in fraudulent sessions that are billed to the users. The home operator of a user is then in the difficult situation either to proof that the user has really used the service (which is usually quite difficult) and to take the risk of loosing a customer, or to distrust business partners up to a degree where conducting business is no longer possible. Allowing untrusted application servers to set up sessions on behalf of users may also give opportunity to spoofing and potential DoS (Denial of Service) attacks to application servers or individual network nodes.
I-CSCF (Interrogating Call Session Control Function) is an IMS (IP Multimedia Subsystem) element that provides a contact point within an operator's network. That is, external nodes (nodes that do not belong to operator network) are allowed to contact the I-CSCF. The I-CSCF hides the internal network topology of an operator from the outside. It has been agreed within 3GPP that the I-CSCF will also handle the requests to set up sessions on behalf of users mentioned above.
In current network settings, there are no measures to make sure that a request received at I-CSCF for setting up a session on behalf of a user is not fraudulent.
One solution for this security issue might be to hardcode a list of all trusted applications into the I-CSCF, i.e. to provide a list with authentication information of trustworthy nodes to the I-CSCF. A problem with this kind of hard-coding is that some type of secure authentication mechanism for authenticating the application server is still needed, since the I-CSCF may be contacted from outside the operator network. Also, the list would need to be updated regularly, which requires some sort of update mechanism. Thus, some add-on in addition to the hard-coding is needed. A further problem is that operators tend to outsource their application development to external parties, and therefore the application server may not be trusted. If the application server is not trusted, some mechanism is needed for ensuring that the connection between the application server and the operator is sufficiently secure.
Another solution is to make the I-CSCF prompt the user for authorizing session initiation by a certain application server. A problem with this approach is that the user may be offline and thereby unable to provide a response. This may prevent the use of pre-scheduled applications. Additionally, prompting the user for authorization may not always be very secure solution as many users tend to allow actions without bothering to read what is asked or without understanding the question or the users may just press “yes” because they want to use the service and know that, if they press “no”, then they will not get the service.
Thus, further security considerations are needed.